A method and apparatus for authenticating a message, said method including receiving, at a device, data representative of a first share, constructing a key using said first share and at least two additional shares, said at least two additional shares being stored at said device; and authenticating a message using said constructed key.
|
1. A method for authenticating a message, said method comprising:
receiving at a device data representative of the message and a first share transmitted with the message;
constructing a key using said first share and at least two additional shares, said at least two additional shares being stored at said device, said first and at least two additional shares constituting a subset of a total number of shares, and representing a threshold number of shares necessary to construct said key; and
authenticating the message using said constructed key.
20. A message authentication system comprising:
a transmitter; and,
a receiver for receiving from the transmitter a message, a message authenticator and a first share transmitted with the message, wherein the receiver includes second and third shares stored therein for authenticating the message, said second and third shares being used in conjunction with said first share to authenticate said message, said first, second and third shares constituting a subset of a total number of shares, and representing a threshold number of shares necessary to authenticate said message.
8. A message authentication system comprising:
at least one message source; and,
at least one message receiver for receiving from the at least one message source a message, a message authenticator and a first share transmitted with the message;
wherein said at least one message receiver includes second and third shares stored therein for authenticating the message, said second and third shares being used in conjunction with said first share to authenticate said message, said first, second and third shares constituting a subset of a total number of shares, and representing a threshold number of shares necessary to authenticate said message.
19. A method for operating a message authentication system comprising the steps of:
transmitting a message, a message authenticator and a first share from a transmitter station to a receiver station;
receiving at the receiver station said message, said message authenticator and said first share transmitted with said message;
constructing a key using said first share and at least two additional shares, said at least two additional shares being stored at the receiver station, said first and at least two additional shares constituting a subset of a total number of shares, and representing a threshold number of shares necessary to construct said key; and
authenticating the message using said constructed key and said message authenticator.
5. A method for providing authentication of a message, said method comprising:
receiving a message authenticator and said message at a device;
receiving at said device data representative of a first share transmitted with the message;
constructing a key using said first share and second and third shares, said second and third shares being stored at said device, said first, second and third shares constituting a subset of a total number of shares, and representing a threshold number of shares necessary to construct said key; and
authenticating said message using said constructed key and said message authenticator, wherein the step of constructing said key comprises calculating the Y-intercept of the curve formed on said Euclidean plane by said first, second and third shares.
7. A system for authenticating a message sent from a first device to a second device, said second device performing the steps of:
receiving a message and a message authenticator;
receiving data representative of a first share transmitted with the message;
constructing a key using said first share and second and third shares, said second and third shares being stored in said second device, said first, second and third shares constituting a subset of a total number of shares, and representing a threshold number of shares necessary to construct said key; and
authenticating said message using said constructed key and said message authenticator, wherein the step of constructing said key comprises calculating the Y-intercept of the curve formed on said Euclidean plane by said first, second and third shares.
2. The method of
3. The method of
4. The method of
6. The method of
9. The method of
10. The method of
11. The method of
12. The method of
13. The method of
14. The method of
15. The method, of
masking the first share before receiving the first share in the device.
16. The method of
computing the first share from the masked version of the first share.
17. The method of
transmitting a first sham and at least one redundant share.
18. The method of
filtering out said at least one redundant share after receiving said first share.
|
|||||||||||||||||||||||||||
This application claims the benefit of U.S. provisional application Ser. No. 60/253,781 filed Nov. 29, 2000, and is a Continuation-in-Part of co-pending U.S. application Ser. No. 09/581,064 filed Oct. 7, 2002, which are hereby incorporated herein by reference.
This invention concerns a system and method for providing message authentication. Utilizing the concept of secret sharing, the system does not require the full keys to be sent to the receiver of the message. Instead, the keys are recovered using at least one share received from the sender and at least two shares stored at the receiver.
In modern electronic distribution networks, message authentication is an important objective of information security. This objective is met by providing the receiver of a message an assurance of the sender's identity. As physical protection such as sealed envelopes is not possible for messages expressed as binary sequences, digital tools have been developed using cryptography. A major weakness of all cryptographic methods for message authentication lies in their use of algorithms with fixed symmetric or public keys. We describe a new key transport scheme, based on secret sharing, which allows each new message to be authenticated with a new key, strengthening the system's resistance to attacks on the key or messages.
Authentication is one of the four most important objectives of information security. The others are confidentiality, data integrity and non-repudiation. In communication networks, some or all of these objectives may need to be met.
With respect to confidentiality, it will be noted that there are applications where information should be kept secret. Encryption techniques provide confidentiality by transforming data into unintelligible format. This is a reversible process, and the entity in possession of the right key can recover the data.
With respect to data integrity, users need to have assurance that information has not been altered in an unauthorized way. Hashing functions, which produce compact representations of data, are commonly used for checking data integrity.
Finally, with respect to non-repudiation, when a dispute arises a result of a party in denial of an action, e.g., involvement an electronic transaction, it can be resolved with the participation of a trusted third party acting as a judge.
There are two basic types of authentication: ‘entity’ authentication and ‘message’ authentication. Message authentication provides assurance of the identity of the originator of the message. Entity authentication provides assurance of the identity of originator of the message, as well as assurance of the active participation of the originator of the message.
As stated above, message authentication provides assurance of the identity of party A, the originator of the message M. Message authentication also includes evidence of data integrity because if the message M is modified during transmission, party A cannot be the originator. Entity authentication, on the other hand, assures party B of not only the identity of party A, but also his active participation. Sometimes, two parties need to authenticate each other for messages to flow in either direction. Challenge-response protocols based on symmetric or public key schemes, and zero-knowledge protocols are commonly used for mutual authentication.
Although message authentication provides no guarantees of timeliness or uniqueness, it is very useful in communications where one party (e.g., party A) is not active during the execution of the message protocol. To avoid replay attacks (i.e., where a pirate masquerades as party A, and sends a previously used message in an attempt to obtain the protocol), time variant data (e.g., sequence numbers, time stamps, etc.) may be added to the message M.
The cryptographic process known as “hashing” is an essential part of data integrity and message authentication schemes. A hash function takes a message of arbitrary finite length and produces an output of fixed length. In cryptographic applications, the hash value is considered to be a shorter representation of the actual message. Hash functions may be classified into two groups: (1) unkeyed hash functions (i.e., the message is the only input parameter), and (2) keyed hash functions (i.e., the message and a secret key are the input parameters).
A particular class of unkeyed hash functions contains Manipulation Detection Codes (MDCs). MDCs differ in the way in which the message M is compressed. Some examples are: (a) hash functions based on block ciphers, (b) hash functions based on modular arithmetic, and (c) customized hash functions.
The keyed hash functions that are used for message authentication are grouped under Message Authentication Codes (MACs). MACs can be customized, constructed using block ciphers, or derived from MDCs.
Message authentication methods may be classified by how they exploit symmetric or public key ciphers: (a) MACs, (b) message encryption, and (c) digital signatures.
If a fixed key is used for creation of MACs, message encryption and digital message signing (i.e., all three message authentication types), the security level would be limited, thereby exposing the system to cryptanalysis.
With respect to the ‘MAC’ method, the symmetric key shared by the sender and the receiver needs to used for all messages during its lifetime. This makes this method vulnerable to attacks for key recovery and MAC forgery. There are two possible attacks: (1) attacks on the key space, and (2) attacks on the MAC value. If the pirate can determine the MAC key, he or she would be able to create a MAC value for any message. For a key size of ‘t’ bits and a fixed input, the probability of finding the correct n-bit MAC is about 2−t. The objective of MAC forgery is to create a MAC for a given message, or to find a message for a given MAC without knowing the key. For an n-bit MAC algorithm, the probability of meeting this objective is about 2−n. In sum, the effort needed for a brute force attack on a MAC algorithm would be the minimum (2t, 2n).
With respect to the message encryption method, this method is also vulnerable to brute force attacks. For example, for a 56-bit DES (symmetric) algorithm, the key may be determined by testing all 255 DES operations. More efficient attacks like linear or differential cryptanalysis allow key recovery with less processor time.
With respect to the digital signature method, no public key signature algorithm has been proven secure. The security of public key algorithms is based on the difficulty of computing discrete logarithms, or factoring large numbers. With a fixed public/private key pair, attacks are possible using the public key or signatures on messages. In some applications, the authenticity of the sender's public key is a major problem requiring complex public key infrastructures.
Thus, there is presently a need for a system for providing message authentication which provides a higher degree of security, but which does not used fixed keys.
The present invention defines a method and apparatus for providing authentication of a message, said method including receiving, at a receiver station, data representative of a first share, constructing a key using said first share and at least two additional shares, said at least two additional shares being stored at said receiver station; and authenticating a message using said constructed key.
In accordance with a first exemplary embodiment of the present invention, first and second shares are used. The first and second shares are points on a Euclidean plane and the step of constructing the key comprises calculating the Y-intercept of the line formed on the Euclidean plane by the first and second shares.
In accordance with a second exemplary embodiment of the present invention, first, second and third shares are used. The first, second and third shares are points on a Euclidean plane and the step of constructing the key comprises calculating the Y-intercept of the parabolic curve formed on the Euclidean plane by the first, second and third shares.
In accordance with a third exemplary embodiment of the present invention, first, second, third and fourth shares are used. The first, second, third and fourth shares are points on a Euclidean plane and the step of constructing the key comprises calculating the Y-intercept of the curve formed on the Euclidean plane by the first, second, third and fourth shares. In general, any number of shares may be used, depending upon the level of security required.
The present invention comprises a message authentication system, where messages sent between two or more parties are authenticated using a prepositioned secret sharing scheme. By using a prepositioned secret sharing scheme, the security and flexibility (e.g., by using different keys) of the message authentication system is increased.
The present invention employs an application of a secret sharing scheme, originally developed by Adi Shamir, known as a ‘threshold scheme’ (See, A. Shamir, “How to share a secret,” Communications of the ACM, Vol. 22, No. 11, pp. 612–613, November 1979). An (t,n) threshold scheme, such as the one proposed by Shamir, involves breaking a secret into n pieces (which may be called ‘shares’ or ‘shadows’) in such a way that at least t (<=n) of the pieces are required to reconstruct the secret. A perfect threshold scheme is a threshold scheme in which knowledge of (t−1) or fewer pieces (‘shares’ or ‘shadows’) provides no information about the secret.
For example, with a (2,5) threshold scheme, the secret is divided into five shares but only two of the shares are required to reconstruct the secret. A (2,5) threshold scheme such as the one described above may be used by a bank manager to divide the combination to the main safe among five tellers. In this way, any two of the tellers working together could open the safe, but one teller alone could not open the safe. In Shamir's (t,n) threshold scheme, choosing a higher value for t, and storing (t−1) secrets in the smart card would increase the system's resistance to ciphertext only attacks, but would lead to more computations for polynomial construction.
Such a threshold scheme reduces the computational requirements in symmetric key recovery. For each new key, only a simple operation is performed (i.e., the value of the polynomial at x=0 is computed), as compared to RSA decryption which involves modular exponentiation. Additionally, security is perfect (i.e., given knowledge of (x1, y1), all values of the secret remain equally probable).
The present invention utilizes the principles of Shamir's secret sharing to conceal the identity of a key for authenticating a message. In particular, the present inventor proposes a scheme where the key comprises the Y-intercept of a specific line or curve formed by two or more points on a Euclidean plane.
In the simplest embodiment of this scheme, a device (e.g., receiver) is manufactured with a share or shares already stored therein (this is often referred to as a ‘prepositioned’ shared secret scheme, as discussed below). This stored share is used to compute the key, which is then used to obtain a message authenticator. The message authenticator may be, for example, of type discussed above with reference to
The key generation and distribution process may be automated by developing a program to perform the following steps:
Such a scheme as the one described above is often referred to as a ‘prepositioned’ shared secret scheme because a portion of the secret is ‘prepositioned’ at the device (e.g., receiver). In the above example, the ‘prepositioned’ share is the share which is stored at the receiver. Such ‘prepositioned’ shared secret schemes have been discussed by others in the field of cryptology (See, G. J. Simmons, “How to (really) share a secret,” Advances in Cryptology—CRYPTO '88 Proceedings, Springer-Verlag, pp. 390–448, 1990; G. J. Simmons, “Prepositioned shared secret and/or shared control schemes,” Advances in Cryptology—EUROCRYPT '89 Proceedings, Springer-Verlag, pp. 436–467, 1990). By prepositioning a certain share or shares, the key can be changed relatively easily without changing any of the circuitry at the receiver; only the ‘activating’ share need to be changed.
It will be noted that the above algorithm outlines a prepositioned secret sharing scheme which utilizes a secret S with only 2 shares (i.e., 2 points of a line on a Euclidean plane). Of course, other secrets S can be computed from many more shares (points), thereby making cryptanalysis more difficult. The important aspect of a prepositioned secret sharing scheme is that some of the shares are ‘prepositioned’ at the receiver.
The present invention involves storing at least one of the shares of a secret at a specific location (e.g., in the receiver hardware). The stored share is then used in conjunction with an ‘activating’ share to construct the secret. In a (4, 4) scheme, for example, preferably three (3) of the four (4) shares are stored at the specific location (e.g., receiver). Then, the last share (also referred to herein as the ‘activating’ share) is transmitted to the location to obtain the secret. It is important to note that with the present invention, the secret is not the shares themselves, but the Y-intercept of the line or curve (for higher order polynomials) formed by the shares when expressed as points on a Euclidean plane.
Particularly, stored in a receiver 50 is a first share (or data point) of the secret. The first share may be thought of as a single point on a Euclidean plane (e.g., in the form of (x0, y0)). Message source 40 transmits a message with a specific authentication protocol to the receiver 50. In addition to the message, message source 40 transmits the message authenticator and a second (or ‘activating’) share (which is a second part of the secret). Similarly to the first share, the second share may be a second single point from the same Euclidean plane (e.g., in the form of (x1, y1)).
In the first exemplary embodiment, the message, the message authenticator (e.g., MAC), and the second (‘activating’) share are received by receiver 50 and are processed within the receiver. The receiver 50 uses the second (‘activating’) share (e.g., (x1, y1)) and the stored first share (e.g., (x0, y0)) to reconstruct (or recover) the key (i.e., secret). The receiver 50 then uses the reconstructed key to generate the message authenticator (e.g., MAC). If the message authenticator (e.g., MAC)computed at the receiver 50 is the same as the message authenticator sent from the message source 40, the message is deemed authentic, if the message authenticators are not the same, the message is rejected.
Recovery of the key is achieved by constructing a polynomial utilizing the first and the second shares; the y-intercept of the constructed polynomial being the key. For example, given (x0, y0) and (x1, y1), the key is constructed by computing the value of S in the given finite field, where:
S=f(0)=y0−((y1−y0)/(x1−x0))*(x0)
Such an approach as the one described above with reference to the first exemplary embodiment permits more than one message source 40 to share the stored (first) share (x0, y0) which is stored at the receiver 50. Each message source 40 would then be free to choose its own ‘activating’ (second) share (i.e., (x1, y1)), thereby defining a broad range of secrets. The probability of constructing polynomials with identical y-intercepts (i.e., identical keys) is low. However, the range of possible second (‘activating’) shares could be allocated such that each service provider has a unique and non-overlapping range (see
To consider an example in accordance with the first exemplary embodiment of the present invention, assume points (x0, y0)=(17,15) and (x1, y1)=(5,10) and p=23. The first-degree polynomial:
f(x)=a1x+a0(mod 23)
passing through (x0, y0) and (x1, y1) can be constructed by solving:
a1(17)+a0=15(mod 23) and
a1(5)+a0=10(mod 23)
The solution (a1, a0)=(10,6) gives the polynomial:
f(x)=10x+6(mod 23)
The value of the secret S can be discovered by computing f(0):
S=f(0)=6(mod 23)
Thus, according to the above example the value of the secret, and thus the key, would be 6 (mod 23). Of course the value of this secret will change with each different value of (x1, y1).
To consider an example in accordance with the second exemplary embodiment of the present invention, assume points (x0, y0)=(17, 15), (x1, y1)=(5, 10), and (x2, y2)=(12, 6), and p=23. The second-degree polynomial:
f(x)=a2x2+a1x+a0(mod 23)
passing through (x0, y0), (x1, y1) and (x2, y2) can be constructed by solving:
a2*(172)+a1*(17)+a0=15(mod 23)
a2*(122)+a1*(12)+a0=6(mod 23) and
a2*(52)+a1*(5)+a0=10(mod 23)
The solution (a2, a1, a0)=(10, 20, 5) gives the polynomial:
f(x)=10x2+20x+5(mod 23)
The value of the secret S can be discovered by computing f(0):
S=f(0)=5(mod 23)
As shown in
To consider an example in accordance with the third exemplary embodiment of the present invention, assume points (x0, y0)=(17, 15), (x1, y1)=(5, 10), (x2, y2)=(12, 6) and (x3, y3)=(3, 12) and p=23. The third-degree polynomial:
f(x)=a2x3+a2x2+a1x+a0(mod 23)
passing through (x0, y0), (x1, y1), (x2, y2) and (x3, y3) can be constructed by solving:
a3*(173)+a2*(172)+a1*(17)+a0=15(mod 23)
a3*(123)+a2*(122)+a1*(12)+a0=6(mod 23)
a3*(53)+a2*(52)+a1*(5)+a0=10(mod 23)
a3*(33)+a2*(32)+a1*(3)+a0=12(mod 23)
The solution (a3, a2, a1, a0)=(18, 19, 0, 22) gives the polynomial:
f(x)=18x3+19x2+0x+22(mod 23)
The value of the secret S can be discovered by computing f(0):
S=f(0)=22(mod 23)
As shown in
Multiple shares may also be used to build a convenient key transport scheme in a communications network. Code authentication, an important issue in digital networks, may be used as a case study. In the future, sophisticated home entertainment devices handling audio/video data will receive software for various applications via digital distribution networks (e.g., satellite, cable, terrestrial, Internet). Identification of the source of this code is an essential requirement for both the service providers delivering the content and the manufacturer of the devices utilizing the content. The service providers would like to have assurance that their application is received an used only by authorized devices. The device manufacturers would, in turn, be concerned about unauthorized services using their devices. Suppose in a given broadcasting system different groups of devices are to be authorized in different ways. The example given below will discuss how prepositioned secret sharing may be used to establish the required key hierarchy.
Consider a broadcast system with three (3) different authentication levels for code authentication:
Using the above example, the table below describes the relationship between the shares and the different authorization levels:
First Degree
Second Degree
Third Degree
Point
Level 1
Level 2
Level 3
Activating Share =
Yes
Yes
Yes
(5, 10)
Level 1 common
Yes
Yes
Yes
share = (17, 15)
Level 2 share =
Yes
Yes
(12, 6)
Level 3 share =
Yes
(3, 12)
Although the above-described method and apparatus have been described in the context of a message authentication system for delivering authentic messages between users, the principles of the present invention may also be applied to a method and apparatus for providing conditional access to multimedia content.
Some of the advantages of the above-described method and apparatus include:
The above-described scheme effectively combines the advantages of symmetric and public key systems. The ‘prepositioned’ information can be considered to be the private key of the receiver. The symmetric key to be constructed is determined by the public information sent as part of the ECM. As the keys are not generated at the message source, no additional cipher is needed to protect them in distribution.
The effectiveness of the above-described schemes can be increased in various ways including:
Any combination of the above-referenced improvements will serve to hide the real value of the activating share in transmission, and introduce an additional level of security for the message.
Although the above discussion primarily centers in the use of a MAC as the message authenticator, those of ordinary skill in the art will recognize that other message authentication methods may be used without departing from the scope of the present invention (e.g., message encryption; See
Although the invention has been described in terms of a secret sharing scheme which may use first, second and third degree polynomial equations in forming a secret, it will be understood by those skilled in the art that any degree polynomial equation (e.g., fourth degree, fifth degree, etc.) may be used. In fact, higher degree polynomial functions will be preferred in that they provide additional security over lower order polynomial functions due to the increased number of shares which must be estimated. Furthermore, although the above description focuses on a system with a single smart card (e.g., smart card 42), it will be understood by those skilled in the art that multiple smart cards may be used, each smart card having one or more share values stored therein.
| Patent | Priority | Assignee | Title |
| 10063374, | May 31 2015 | Massachusetts Institute of Technology | System and method for continuous authentication in internet of things |
| 11438147, | Sep 30 2016 | Intel Corporation | Technologies for multiple device authentication in a heterogeneous network |
| 11777917, | Oct 15 2020 | Cisco Technology, Inc.; Cisco Technology, Inc | Multi-party cloud authenticator |
| 8068606, | Aug 29 2007 | Red Hat, Inc. | Embedding a secret in a bit string for safeguarding the secret |
| 8243933, | Aug 29 2007 | Red Hat, Inc. | Method for sharing secret information among cooperating parties |
| 8615084, | May 29 2008 | Red Hat, Inc.; Red Hat, Inc | Extending a secret bit string to safeguard the secret |
| 9076188, | Apr 13 2005 | Hewlett-Packard Development Company, L.P. | Method and system for shipment authentication |
| 9378518, | Dec 30 2004 | Topaz Systems, Inc. | Electronic signature security system |
| Patent | Priority | Assignee | Title |
| 4797672, | Sep 04 1986 | AVAYA TECHONOLGY CORP | Voice network security system |
| 6490680, | Dec 04 1997 | TecSec Incorporated | Access control and authorization system |
| WO49756, |
| Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
| Sep 24 2001 | Thomson Licensing | (assignment on the face of the patent) | / | |||
| Oct 23 2001 | ESKICIOGLU, AHMET | THOMSON LICENSING S A | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 012210 | /0856 | |
| Oct 18 2006 | THOMSON LICENSING S A | Thomson Licensing | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 018705 | /0116 |
| Date | Maintenance Fee Events |
| Aug 10 2004 | ASPN: Payor Number Assigned. |
| Nov 08 2010 | REM: Maintenance Fee Reminder Mailed. |
| Apr 03 2011 | EXP: Patent Expired for Failure to Pay Maintenance Fees. |
| Date | Maintenance Schedule |
| Apr 03 2010 | 4 years fee payment window open |
| Oct 03 2010 | 6 months grace period start (w surcharge) |
| Apr 03 2011 | patent expiry (for year 4) |
| Apr 03 2013 | 2 years to revive unintentionally abandoned end. (for year 4) |
| Apr 03 2014 | 8 years fee payment window open |
| Oct 03 2014 | 6 months grace period start (w surcharge) |
| Apr 03 2015 | patent expiry (for year 8) |
| Apr 03 2017 | 2 years to revive unintentionally abandoned end. (for year 8) |
| Apr 03 2018 | 12 years fee payment window open |
| Oct 03 2018 | 6 months grace period start (w surcharge) |
| Apr 03 2019 | patent expiry (for year 12) |
| Apr 03 2021 | 2 years to revive unintentionally abandoned end. (for year 12) |